Compliance
Where we sit in your governance, stated plainly
Anything touching NHS data gets asked these questions eventually. Here are the answers up front, including the ones that are still in progress.
Data protection
Who controls the data
In most of our work the arrangement is the same. The trust is the controller. The operator or agency we contract with is the processor. We act as a sub-processor under a written agreement, and we hold no relationship with the data subject directly.
That matters practically: we act on documented instructions from our client, we do not decide what data is collected or why, and we do not use anything we process for any purpose of our own.
Where we contract directly with a trust, the trust is the controller and we are the processor. The agreement is put in place before any access is granted, not alongside the first delivery milestone.
Assurance
Certifications and registrations
Stated honestly, including where work is outstanding. We would rather you knew now than found out during due diligence.
| What | Status |
|---|---|
| ICO data protection register | [registration number required] |
| NHS Data Security and Protection Toolkit | [status required] |
| Cyber Essentials | [status required] |
| Cyber Essentials Plus | [status required] |
| ISO 27001 | [status required] |
| DCB0129 — clinical risk management, manufacturer | [status required] |
| DCB0160 — clinical risk management, deployer | [status required] |
[This table publishes nothing until each status is confirmed. An overstated certification is the fastest way to lose a procurement.]
Clinical risk
Clinical safety
Every deployment that touches a clinical workflow gets a hazard log. It is produced by us, reviewed by your Clinical Safety Officer, and signed before anything goes live. Not after the pilot, not alongside acceptance testing — before.
Our software does not take clinical action without human oversight and does not participate in clinical decision-making. That is a permanent boundary rather than a roadmap position, and it shapes what we will accept as a piece of work.
Third-party systems
Working through another supplier’s system
Where a supplier publishes an interface, we use it. Where none exists, we work through the same screens your team uses.
That second case is a contractual question before it is a technical one. Before a single automated sign-in we get your written agreement and check the platform supplier’s terms. If those terms prohibit it, we tell you and we do not proceed.
Send us your due diligence questionnaire
We would rather answer it before a conversation gets serious than halfway through a procurement.